#sast

Reachability triage for vulnerability scans. Feeds scanner findings to an LLM agent that reads your source and decides which CVEs are actually reachable.

Eight security skills for Claude Code with no dependencies: standard library only, tested, and usable as a CI step. Secret scanning, Python SAST, prompt-injection testing, plus HTTP, JWT, Dockerfile, CORS and dependency auditing.

Development-time local workspace security alignment for AI coding agents

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

Offline, no-AI "safe to ship?" gate for vibe-coded apps — finds the security mistakes AI coding agents make (secrets, unprotected routes, eval-RCE, SQLi, CORS, JWT, leaked keys). CLI + MCP, agent-runnable.

Skill de sécurité applicative pour agents de code IA (Claude Code, Cursor, Codex) — détection, explication, correction et scoring OWASP/ASVS.

The complete security auditor for Claude Code — web, API, mobile, cloud, wireless, code, secrets, dependencies, IaC, containers and LLM apps. Token-optimised, exploitation-ranked, self-updating.

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

Evidence-first source security scanner for human-written and AI-generated code. Rust CLI with AST review, bounded taint, explicit coverage, JSON/SARIF, and agent workflows.

Read-only local security gate & scanner for AI coding workflows, MCP, and package hallucination risks.

Local-first security release checker for authorized code, AI apps, freelancers, and small teams

Evidence-based multi-pass repository audits for Codex, Claude Code, and Agent Skills-compatible coding agents.

A purple-team of AI agents that audits code security and proves findings by execution — not by opinion.

Local SonarQube for AI agents: one shared SonarQube server + SonarQube MCP server for Claude Code, Cursor, opencode, VS Code and Codex. Single Go binary for Linux, macOS and Windows.

Agent skills for running security scans — secret scanning (gitleaks), dependency CVE audit (npm/cargo/osv), SAST (semgrep), and a composed pre-release gate. Grounded SKILL.md runbooks for Vanta / Claude Code / any skill-aware agent. MIT.

Security scanner for AI-generated code — GitHub Action + CLI wrapping Semgrep, Gitleaks, and an AI-agent-specific rule pack.

外部工具接入——CLI 编码 agent 统一调用/公开资料检索/git 工作副本沙箱/确定性 SAST 扫描